v0.66.2: FileBrowser umask 002 via entrypoint wrapper

gtstef/filebrowser is a single Go binary that ignores a UMASK env (verified live:
-e UMASK=002 leaves PID1 0022), so RenderFileBrowserCompose wraps the entrypoint
sh -c 'umask 002; exec /home/filebrowser/filebrowser'. Customer-created folders now
come out 2775 (group-writable) so group-1000 apps can write into them. Test asserts
the wrapper is rendered.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

controller/internal/infra/infra.go

@@ -129,6 +129,11 @@ services:
     image: %s
     container_name: filebrowser
     restart: unless-stopped
+    # umask 002 so folders the customer creates here come out group-writable (2775 with the parent's
+    # setgid), letting the content apps (group 1000) write into them. The gtstef/filebrowser image is a
+    # single Go binary (entrypoint ./filebrowser) and does NOT honor a UMASK env (verified: -e UMASK=002
+    # leaves PID1 at 0022), so we wrap the entrypoint to set the process umask before exec.
+    entrypoint: ["sh", "-c", "umask 002; exec /home/filebrowser/filebrowser"]
     environment:
       - TZ=Europe/Budapest
       - FILEBROWSER_CONFIG=/home/filebrowser/config.yaml

controller/internal/infra/infra_test.go

@@ -223,4 +223,10 @@ func TestFileBrowserRender(t *testing.T) {
 	if !strings.Contains(withMounts, "/mnt/hdd_1:/srv/hdd_1") {
 		t.Errorf("storage mount not wired into filebrowser compose: %q", withMounts)
 	}
+
+	// v0.66.2: the entrypoint wrapper sets umask 002 so customer-created folders are group-writable
+	// (2775). The image doesn't honor a UMASK env, so this MUST be the entrypoint mechanism.
+	if !strings.Contains(compose, `entrypoint: ["sh", "-c", "umask 002; exec /home/filebrowser/filebrowser"]`) {
+		t.Errorf("filebrowser compose missing the umask-002 entrypoint wrapper: %q", compose)
+	}
 }